Auto-run scripts security options
It seems that the order is as follows (in order from weakest to strongest):


Startup .blend settings (does not override anything)
--factory-startup will override all startup .blend preferences (including auto exec), but the default setting for auto exec is disabled (disallowing auto execution globally).
-y (--enable-autoexec) enables -Y (--disable-autoexec) disablesBoth these options override the startup .blend auto exec preferences (including when used with --factory-startup) allowing auto execution. Note that it does not edit the preferences (even temporarily), it just allows execution.
Running a script with -P (--python, --python-text, --python-expr) will execute the script immediately ignoring auto-execution settings. It is possible to enable auto-execution from such a script.